* [PATCH v2] usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error path of .probe()
@ 2024-12-16 1:55 Joe Hattori
2024-12-17 6:18 ` Peter Chen
0 siblings, 1 reply; 2+ messages in thread
From: Joe Hattori @ 2024-12-16 1:55 UTC (permalink / raw)
To: peter.chen, gregkh, shawnguo, s.hauer, kernel, festevam
Cc: linux-usb, Joe Hattori, stable
Current implementation of ci_hdrc_imx_driver does not decrement the
refcount of the device obtained in usbmisc_get_init_data(). Add a
put_device() call in .remove() and in .probe() before returning an
error.
This bug was found by an experimental static analysis tool that I am
developing.
Cc: stable@vger.kernel.org
Fixes: f40017e0f332 ("chipidea: usbmisc_imx: Add USB support for VF610 SoCs")
Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
---
Changes in v2:
- Put the device in .remove() as well.
---
drivers/usb/chipidea/ci_hdrc_imx.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index f2801700be8e..1a7fc638213e 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -370,25 +370,29 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
data->pinctrl = devm_pinctrl_get(dev);
if (PTR_ERR(data->pinctrl) == -ENODEV)
data->pinctrl = NULL;
- else if (IS_ERR(data->pinctrl))
- return dev_err_probe(dev, PTR_ERR(data->pinctrl),
+ else if (IS_ERR(data->pinctrl)) {
+ ret = dev_err_probe(dev, PTR_ERR(data->pinctrl),
"pinctrl get failed\n");
+ goto err_put;
+ }
data->hsic_pad_regulator =
devm_regulator_get_optional(dev, "hsic");
if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) {
/* no pad regulator is needed */
data->hsic_pad_regulator = NULL;
- } else if (IS_ERR(data->hsic_pad_regulator))
- return dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
+ } else if (IS_ERR(data->hsic_pad_regulator)) {
+ ret = dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
"Get HSIC pad regulator error\n");
+ goto err_put;
+ }
if (data->hsic_pad_regulator) {
ret = regulator_enable(data->hsic_pad_regulator);
if (ret) {
dev_err(dev,
"Failed to enable HSIC pad regulator\n");
- return ret;
+ goto err_put;
}
}
}
@@ -402,13 +406,14 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
dev_err(dev,
"pinctrl_hsic_idle lookup failed, err=%ld\n",
PTR_ERR(pinctrl_hsic_idle));
- return PTR_ERR(pinctrl_hsic_idle);
+ ret = PTR_ERR(pinctrl_hsic_idle);
+ goto err_put;
}
ret = pinctrl_select_state(data->pinctrl, pinctrl_hsic_idle);
if (ret) {
dev_err(dev, "hsic_idle select failed, err=%d\n", ret);
- return ret;
+ goto err_put;
}
data->pinctrl_hsic_active = pinctrl_lookup_state(data->pinctrl,
@@ -417,7 +422,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
dev_err(dev,
"pinctrl_hsic_active lookup failed, err=%ld\n",
PTR_ERR(data->pinctrl_hsic_active));
- return PTR_ERR(data->pinctrl_hsic_active);
+ ret = PTR_ERR(data->pinctrl_hsic_active);
+ goto err_put;
}
}
@@ -527,6 +533,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
if (pdata.flags & CI_HDRC_PMQOS)
cpu_latency_qos_remove_request(&data->pm_qos_req);
data->ci_pdev = NULL;
+err_put:
+ put_device(data->usbmisc_data->dev);
return ret;
}
@@ -551,6 +559,7 @@ static void ci_hdrc_imx_remove(struct platform_device *pdev)
if (data->hsic_pad_regulator)
regulator_disable(data->hsic_pad_regulator);
}
+ put_device(data->usbmisc_data->dev);
}
static void ci_hdrc_imx_shutdown(struct platform_device *pdev)
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error path of .probe()
2024-12-16 1:55 [PATCH v2] usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error path of .probe() Joe Hattori
@ 2024-12-17 6:18 ` Peter Chen
0 siblings, 0 replies; 2+ messages in thread
From: Peter Chen @ 2024-12-17 6:18 UTC (permalink / raw)
To: Joe Hattori
Cc: gregkh, shawnguo, s.hauer, kernel, festevam, linux-usb, stable
On 24-12-16 10:55:39, Joe Hattori wrote:
> Current implementation of ci_hdrc_imx_driver does not decrement the
> refcount of the device obtained in usbmisc_get_init_data(). Add a
> put_device() call in .remove() and in .probe() before returning an
> error.
>
> This bug was found by an experimental static analysis tool that I am
> developing.
>
> Cc: stable@vger.kernel.org
> Fixes: f40017e0f332 ("chipidea: usbmisc_imx: Add USB support for VF610 SoCs")
> Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
Acked-by: Peter Chen <peter.chen@kernel.org>
> ---
> Changes in v2:
> - Put the device in .remove() as well.
> ---
> drivers/usb/chipidea/ci_hdrc_imx.c | 25 +++++++++++++++++--------
> 1 file changed, 17 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
> index f2801700be8e..1a7fc638213e 100644
> --- a/drivers/usb/chipidea/ci_hdrc_imx.c
> +++ b/drivers/usb/chipidea/ci_hdrc_imx.c
> @@ -370,25 +370,29 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
> data->pinctrl = devm_pinctrl_get(dev);
> if (PTR_ERR(data->pinctrl) == -ENODEV)
> data->pinctrl = NULL;
> - else if (IS_ERR(data->pinctrl))
> - return dev_err_probe(dev, PTR_ERR(data->pinctrl),
> + else if (IS_ERR(data->pinctrl)) {
> + ret = dev_err_probe(dev, PTR_ERR(data->pinctrl),
> "pinctrl get failed\n");
> + goto err_put;
> + }
>
> data->hsic_pad_regulator =
> devm_regulator_get_optional(dev, "hsic");
> if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) {
> /* no pad regulator is needed */
> data->hsic_pad_regulator = NULL;
> - } else if (IS_ERR(data->hsic_pad_regulator))
> - return dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
> + } else if (IS_ERR(data->hsic_pad_regulator)) {
> + ret = dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
> "Get HSIC pad regulator error\n");
> + goto err_put;
> + }
>
> if (data->hsic_pad_regulator) {
> ret = regulator_enable(data->hsic_pad_regulator);
> if (ret) {
> dev_err(dev,
> "Failed to enable HSIC pad regulator\n");
> - return ret;
> + goto err_put;
> }
> }
> }
> @@ -402,13 +406,14 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
> dev_err(dev,
> "pinctrl_hsic_idle lookup failed, err=%ld\n",
> PTR_ERR(pinctrl_hsic_idle));
> - return PTR_ERR(pinctrl_hsic_idle);
> + ret = PTR_ERR(pinctrl_hsic_idle);
> + goto err_put;
> }
>
> ret = pinctrl_select_state(data->pinctrl, pinctrl_hsic_idle);
> if (ret) {
> dev_err(dev, "hsic_idle select failed, err=%d\n", ret);
> - return ret;
> + goto err_put;
> }
>
> data->pinctrl_hsic_active = pinctrl_lookup_state(data->pinctrl,
> @@ -417,7 +422,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
> dev_err(dev,
> "pinctrl_hsic_active lookup failed, err=%ld\n",
> PTR_ERR(data->pinctrl_hsic_active));
> - return PTR_ERR(data->pinctrl_hsic_active);
> + ret = PTR_ERR(data->pinctrl_hsic_active);
> + goto err_put;
> }
> }
>
> @@ -527,6 +533,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
> if (pdata.flags & CI_HDRC_PMQOS)
> cpu_latency_qos_remove_request(&data->pm_qos_req);
> data->ci_pdev = NULL;
> +err_put:
> + put_device(data->usbmisc_data->dev);
> return ret;
> }
>
> @@ -551,6 +559,7 @@ static void ci_hdrc_imx_remove(struct platform_device *pdev)
> if (data->hsic_pad_regulator)
> regulator_disable(data->hsic_pad_regulator);
> }
> + put_device(data->usbmisc_data->dev);
> }
>
> static void ci_hdrc_imx_shutdown(struct platform_device *pdev)
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-12-17 6:18 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-12-16 1:55 [PATCH v2] usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error path of .probe() Joe Hattori
2024-12-17 6:18 ` Peter Chen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox